Well that would depend, are you a "gatekeeper", as defined in the Regulation?

That is, do you have a significant impact on the EU's internal market (a turnover of €7.5bn or a €75bn market cap), provide a core platform service which is important for business users to reach end users (have have 45m monthly active end-users in the EU or 10k monthly active business users), enjoy an entrenched and durable position in your operations or foresee that you will enjoy such a position in the near future (i.e. you meet the above for three consecutive years)?

If you answered "no" to any part of that then you are not a gatekeeper, and these regulations do not apply to you.

I don’t know how useful this particular hypothetical is, but it’s definitely a “code smell” that the proposed company’s seemingly only options would be to limit sales to retain the “not a gatekeeper” status or stop doing business in the EU.

I would love to read some surveys on this matter, because I highly doubt that security/privacy is a significant factor for more than a few percent points of iPhone buyers.

(I base this hypothesis on the fact that, in virtually every field of technology, end users have shown that they will overwhelmingly sacrifice privacy and security in exchange for convenience and cost savings.)

I expect that the main motivations for iPhone purchases are aesthetics, performance, ease of use, integration with the Apple ecosystem, and especially fashion/status symbol factor.

As for the rest of the comment, as other people have already pointed out, you can prevent evil maid attacks by putting the legally-required "open" mode behind a factory reset. Which is roughly what Android phones do with their unlockable bootloaders.

That's a false assumption.

At the end of the day, consumers aren't children. If they so choose to destroy what the manufacturer gives them, that is their choice.

I did some cool things with early Android that made the phone tailored to me. If I wanted stock, it was just a reflash away. This is the way.

This is how Xbox currently works in that you can’t play any regular games if you enable developer mode to run unsigned code. I’m going to go out on a limb here and say that, if Apple complied by disabling apps downloaded via their own store when a user is using a 3p store, then the EU would laugh and fine then $x millions of dollars per week.

To avoid this it seems you’d either be forced to sell it at an insane markup (to avoid having too many users) or means test people to make sure they don’t purchase it if they’re not super vulnerable to attacks that matter.

The obvious solution, for your hypothetical, would be to give a setting to the user, that turns on "safe mode" and make this setting only changeable on factory reset.

So any user could choose, at startup, to have safe mode on or off, on their own device.

Problem solved.

The restrictions inherent in the device (including only having a few apps that have been thoroughly reviewed by security researchers) would keep most people away.

The players this regulation target are pretty obvious. It's those that have gained such market dominance along the years that it has become unfair competition for newer players. It is the outcome of years of consumer pressures and entrepreneurs who are calling out for some government actions because markets are regulated anyway everywhere in the world, and these US based companies (for the most part for now) have lobbied along the years to get away with their practice but the EU has decided their lobbying won't do with them. At least not anymore.